Skip to content

ci: one queen-publish job opens the derived-record PRs the labs' verdicts allow (Closes #9092) - #9117

Merged
gHashTag merged 2 commits into
masterfrom
derived/opener-9092
Oct 11, 2026
Merged

ci: one queen-publish job opens the derived-record PRs the labs' verdicts allow (Closes #9092)#9117
gHashTag merged 2 commits into
masterfrom
derived/opener-9092

Conversation

@gHashTag

@gHashTag gHashTag commented Oct 11, 2026

Copy link
Copy Markdown
Owner

Closes #9092

Waits for the owner's owner-approved-foreign label. The PR edits a workflow, so the own-language path check denies it until the label is set. The foreign-line budget passes: 37 lines added, 66 deleted. Nothing else here needs the label.

Why

The labs recompute master's derived records but hold no GitHub credential, and none may be added:

Until something opens their PRs, a person does it by hand, as on 2026-10-11 in #9070, #9073, #9079 and #8289 through #8697.

Which workflow

queen-publish.yml. It already opens PRs, on cron 9,39 * * * * and on every queen-* push, with GH_AGENT_TOKEN. GITHUB_TOKEN may not create PRs here; see its own comment.

Not brain-seal-refresh.yml. It has contents: read, and its push step was removed in #3324, so it can open nothing. It failed its last 9 runs (2026-04-07 to 2026-09-24), and its inline schema check imports jsonschema, which the runner does not have. This PR deletes it. .trinity/seals/brain_pipeline.json still names it under ci_integration; that descriptive file is left for its owner, because a hand edit under .trinity/seals/ is the thing this work removes.

The job: derived-records

  1. It reads each lab's latest master run:
    • t27c-lab: latest.json heads.master.sha, then /seals/<sha>.json;
    • t27b-lab: latest.json commit, then /ledger/<sha>.json.
  2. It refuses unless all of these hold:
    • the commit is on master (merge-base --is-ancestor);
    • the verdict allows a PR: REFRESH for seals (derived_data.t27 seal_refresh), APPLY for the ledger (ledger_steward.t27 run_verdict);
    • every path in git apply --numstat is the kind's derived path: .trinity/seals/ or docs/reports/t27b_expectations.json;
    • git apply --check passes on master's current tip.
  3. Idempotency: it skips when the branch already exists on origin, and it reuses an issue found by <sha12> in its title. So a commit never gets a second issue or PR.
  4. It opens one issue. Ledger issues get the label t27b-ledger-steward.
  5. It pushes bot/seals-<sha12> or steward/t27b-ledger-<sha12> with the patch applied unchanged (git apply --index).
  6. It opens the PR with body line 1 Closes #<issue> and a table of every finding or seal. It then enables --auto --squash while checks are pending: bot_pr_action B_WAIT, card steps 3-6.
  7. An older open bot PR of the same kind is closed: B_REGENERATE, never rebased.
  8. A REFUSE ledger verdict opens one refusals issue for the run, listing each finding's action and refusal_reason (card step 1). It opens no PR.

Checked

The script was run locally against a local copy of the lab outputs, with gh stubbed and git push sent to a local bare repository:

  • Seals: the replayed run ce1a007 (4 seals REFRESH) gave one commit touching exactly those 4 seal files.
  • Ledger: the replayed run 6939621 (5 UNLISTED rows ADD) gave one commit touching only the ledger.
  • Each got its issue, its PR with Closes #<issue> on line 1, and an auto-merge call.
  • A planted REFUSE opened only the refusals issue.
  • A lab head that is not a master commit is skipped.

Until this has the label, I run the same steps by hand from the lab outputs (coordinator's instruction), with each patch applied unchanged.

🤖 Generated with Claude Code

@claude
ci: one queen-publish job opens the derived-record PRs the labs' verd…
80a426f 
…icts allow (Closes #9092)

The labs hold no GitHub credential. On each master run:
- t27c-lab publishes /seals/<sha>.patch|.json (see #9080);
- t27b-lab publishes /ledger/<sha>.patch|.json (see #9091).

This job, `derived-records` in queen-publish.yml (cron 9,39, plus every
queen-* push, with GH_AGENT_TOKEN), takes each lab's latest master run.
It refuses unless the run's commit is on master, the json verdict
allows it (REFRESH / APPLY), every path the patch touches is that
kind's derived path, and `git apply --check` passes on master's tip.
It then:
- opens one issue (t27b-ledger-steward for the ledger);
- pushes bot/seals-<sha12> or steward/t27b-ledger-<sha12> with the
  patch applied unchanged;
- opens the PR, `Closes #<issue>` on line 1;
- enables --auto --squash while checks are pending.
That is bot_pr_action B_WAIT and card steps 3-6. An older open bot PR
of the same kind is closed (B_REGENERATE). A REFUSE verdict opens one
refusals issue for the run (card step 1). It is idempotent: an issue
found by title, or a branch on origin, stops a second one.

brain-seal-refresh.yml is deleted: it opened nothing (its push step
was removed in #3324), it failed its last 9 runs, and the derived-record
PR path is this job. queen-publish.yml: 37 lines added; 66 deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag
gHashTag enabled auto-merge (squash) October 11, 2026 13:40
This was referenced Oct 11, 2026
Open
Merged
Open
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
@github-actions

github-actions Bot commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-11 14:06:55 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 41
PRs with All Checks Green 9
READY 7
FAILING 41
PENDING 0
NO CHECKS YET 0

These columns do not partition: 7 + 41 + 0 + 0 = 48, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=acd3761a1ebf != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

This was referenced Oct 11, 2026
Merged
Merged
Merged
Merged
Merged
Open
Merged
Merged
Merged
Merged
Open
Merged
Merged
Merged
This was referenced Oct 11, 2026
Merged
Merged
Merged
Merged
Open
Merged
Merged
Merged
Merged
@gHashTag gHashTag mentioned this pull request Oct 11, 2026
Merged
This was referenced Oct 11, 2026
Merged
Closed
Open
Merged
Open
Open
Merged
Merged
Merged
Open
Open
Merged
@github-actions

github-actions Bot commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-11 19:53:33 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 49
PRs with All Checks Green 1
READY 0
FAILING 49
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 49 + 0 + 0 = 49, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=6fc1fc5cb363 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag merged commit 9a092df into master Oct 11, 2026
22 of 25 checks passed
gHashTag added a commit that referenced this pull request Oct 11, 2026
@gHashTag @claude
release: t27o signed binary, cosign keyless signing, reusable golden-…
b54ad9a 
…spec Action (#9147)

Ship the t27o-as-a-service surface (#8996, epic #8998): a foreign repo
consumes t27o entirely inside its own GitHub Actions, with zero LLM
tokens and zero secrets of ours.

- t27o-release.yml: on tag t27o-v*, build tri + t27c, checksum, sign
  every artifact cosign keyless (OIDC id-token, no owner secret),
  attest build provenance, upload to the GitHub Release. Signs
  in-workflow because a GITHUB_TOKEN release never fires on:release
  workflows (GitHub anti-recursion), so sign-release.yml cannot cover it.
- t27o-golden.yml: reusable workflow_call. Downloads the signed
  artifacts, verifies each blob's sigstore bundle against the exact
  workflow+tag identity, runs tri t27o --check over the caller's Rust.
  golden opens a PR with specs/t27o_check (refusals inline in each
  spec); scan reports in place; check fails on drift.
- specs/tools/t27o/service.t27: the logic the plumbing carries (modes,
  defaults, tag family, OIDC issuer + identity, report shape, honest
  limit); golden criteria remain #8997's lane. 4/4 tests green (lab).
- specs/port/scripts/gen_w374.t27: scripts/gen_w374.py ported to the
  gen_w392 shape with the invariant-end, last-block and splice made
  real; chain test proves the Python result. w375/w376 tables kept in
  its header. 8/8 tests green (lab). gen_w37[456].py deleted.

Foreign lines: +65 yml, -123 py, net -58 (foreign-budget hook: pass).
str .len counts the $ sentinel (lab probe). own-language hook denies
the two new .yml paths -- same state as open PR #9117: red on CI until
the owner lists them in tools/policy/foreign-exceptions.txt (checklist
on the issue). Untested until first release run: live cosign keyless,
upload, download-verify chain, caller-side PR creation.

Refs #8996

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag added a commit that referenced this pull request Oct 12, 2026
@gHashTag @claude
policy: also list gates.rs for the dead-test deletion follow-up
1c9120d 
#9117 deleted brain-seal-refresh.yml and left the test in gates.rs that
include_str!s it, so cargo test of the tri crate fails to compile on
master. The follow-up is a pure deletion of the dead test (18 lines
removed, none added), delegated by the owner in chat 2026-10-12.

Riding in the same exceptions PR so one label click unblocks both
follow-ups.

Refs #9117

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 12, 2026
Open
Merged
gHashTag added a commit that referenced this pull request Oct 12, 2026
@gHashTag @claude
claw: gates regen 65->66 (t27o workflows in, brain-seal-refresh out) …
dbf1920 
…+ recipes AF4 round 2 (attest-input-rename) (#9297)

Matrix-regen fired for the first time on real drift: gates.t27 was 3 rows off
master (.github/workflows gained t27o-golden and t27o-release from #9147, and
#9117 deleted brain-seal-refresh). Regen per docs/claw/README.md: census
61 blocking + 3 soft + 2 reporting, pins re-indexed (oracle-nightly 30->29,
queen-publish 42->41, new rows pinned at 57/58 with their events).

recipes.t27 AF4 round 2 (#9285): +1 verified row -- t27o-release /
attest-input-rename (#9164: attest-build-provenance v4 renamed the input
path -> subject-path; one-word workflow edit, then delete and re-push the tag).
Table 21 -> 22 rows, census C_AUTO 16 / C_REVIEW 3 / C_OWNER 3. The fallback
row's COND now carries the compare-vs-master discipline every night tick ran
(a red on a PR describes the branch; its cause may be master; a stale failed
run describes an old SHA).

Two bound defects fixed in the same commit:
- recipes all_kinds_unique kept 19-row while bounds through the 21-row table
  (rows 19-20 were never compared); it takes the row count as a parameter now,
  tied to COUNT by the test.
- gates all_names_unique inner bound stayed 65 when the outer grew to 66: the
  computed range (i+1)..65 at i=65 inverts (66..65) and the lowering does not
  clamp it to empty -- the walk went wrong and no_duplicate_names_pairwise
  failed. Both bounds are 66 now, with a comment naming the trap; the unclamped
  inverted range is recorded for the compiler lane.

Lab (fresh t27c from master tip): typecheck OK both files; gates 10/10 tests,
recipes 11/11, 0 FAIL, 0 vacuous. ASCII clean, no new duplicate groups.

Refs #9285, #9281. Part of #9271.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Derived-record PR opener: one queen-publish.yml job opens the PRs the labs' seal and ledger verdicts allow

2 participants

@gHashTag @claude